CVE-2026-80437 — Ninja Forms 3.14.10 - 3.15.1 - Unauthenticated Arbitrary Shortcode Execution via IP and Referer Merge Tags

CVE-2026-80437

Ninja Forms 3.14.10 - 3.15.1 - Unauthenticated Arbitrary Shortcode Execution via IP and Referer Merge Tags PUBLISHED

Description (CNA)

The Ninja Forms WordPress plugin from 3.14.10 before 3.15.2 does not prevent shortcodes in request-derived values from being executed when it substitutes them into content it later processes for shortcodes, allowing unauthenticated users to run any shortcode registered on the site.

Affected (CNA)

Vendor / product	Versions
Unknown / Ninja Forms	affected 3.14.10 before 3.15.2

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/473a3321-7dc6-454a-82f4-89b6a393d09a/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.